{"id":102521,"date":"2021-12-08T15:36:53","date_gmt":"2021-12-08T13:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej"},"modified":"2021-12-08T15:36:53","modified_gmt":"2021-12-08T13:36:53","slug":"github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","title":{"rendered":"GitHub rakendab NPM-is kohustuslikku ulatuslikku kontode verifikatsiooni","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Seoses suurenenud juhtumitega suurte projektide repode h\u00f5ivamisest ja pahatahtliku koodi edendamisest arendajate kontode kompromiteerimise kaudu, kehtestab ettev\u00f5te GitHub laialdase t\u00e4iustatud konto autentimise. Eraldi 500 populaarseima NPM-paketi hooldajatele ja administraatoritele kehtestatakse j\u00e4rgmise aasta alguses kohustuslik kahefaktoriline autentimine. <\/p>\n

7. detsembrist 2021 kuni 4. jaanuarini 2022 kantakse k\u00f5ik need hooldajad, kellel on NPM-pakettide avaldamise \u00f5igus, kuid kes ei kasuta kahefaktorilist autentimist, \u00fcle t\u00e4iustatud konto autentimise kasutamisele. T\u00e4iustatud autentimine t\u00e4hendab, et sisselogimisel npmjs.com v\u00f5i autentimise toimingu teostamisel npm utiliidis tuleb sisestada \u00fchekordne kood, mis saadetakse e-posti aadressile. <\/p>\n

T\u00e4iustatud autentimine ei asenda, vaid t\u00e4iendab varasemalt kergelt valikulist kahefaktorilist autentimist, kus tuleb kinnitada \u00fchekordsete paroolide (TOTP) abil. Kui kahefaktoriline autentimine on sisse l\u00fclitatud, ei rakendata e-posti p\u00f5hist t\u00e4iustatud autentimist. Alates 1. veebruarist 2022 alustatakse 100 populaarseima NPM-paketi hooldajate kohustuslikku \u00fcle viimist kahefaktorilisele autentimisele, mis omavad k\u00f5ige rohkem s\u00f5ltuvusi. P\u00e4rast esimese saja migratsiooni l\u00f5petamist kehtestatakse muudatus 500 populaarseima NPM-paketi jaoks s\u00f5ltuvuste arvu j\u00e4rgi. <\/p>\n

Lisaks praegu saadaval olevale kahefaktorilisele autentimise s\u00fcsteemile, mis p\u00f5hineb \u00fchekordsete paroolide genereerimise rakendustel (nt Authy, Google Authenticator, FreeOTP jms), plaanitakse aprillis 2022 lisada v\u00f5imalus kasutada riistvaraklaave ja biomeetrilisi skannereid, mis toetavad WebAuthni protokolli, samuti v\u00f5imalust registreerida ja hallata erinevaid t\u00e4iendavaid autentimise tegureid. <\/p>\n

Tuletame meelde, et 2020. aastal l\u00e4bi viidud uuringu kohaselt kasutab vaid 9,27% pakettide hooldajatest ligip\u00e4\u00e4su kaitsmiseks kahefaktorilist autentimist. Samuti \u00fcritas 13,37% juhtudel, kui registreeriti uusi kontosid, arendajad uuesti kasutada kompromiteeritud paroole, mis on kajastatud tuntud paroolilekete seas. Paroolide kasulikkuse kontrollimise k\u00e4igus \u00f5nnestus p\u00e4\u00e4seda 12% NPM kontodele (13% paketidest) t\u00e4nu ettearvatavate ja triviaalsete paroolide, nagu n\u00e4iteks \"123456\", kasutamisele. Probleemsete seas olid neli kasutajakontot 20 k\u00f5ige populaarsema paketi seas, 13 kasutajakontot, mille paketid said \u00fcle 50 miljoni allalaadimise kuus, 40 \u2013 \u00fcle 10 miljoni allalaadimise kuus ja 282, millel oli rohkem kui 1 miljon allalaadimist kuus. Arvestades moodulite allalaadimist s\u00f5ltuvusainete ahelas, v\u00f5is ebaturvaliste kontode kompromiteerimine m\u00f5jutada kokku kuni 52% k\u00f5igist NPM moodulitest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub rakendab NPM-is kohustuslikku t\u00e4iendavat kontrolli kontodele | ProHoster","description":"Seoses suurenenud juhtumitega suurte projektide hoidlate haaramisest ja pahatahtliku koodi edendamisest arendajate kontode kompromiteerimise kaudu, rakendab ettev\u00f5te GitHub laialdast t\u00e4iendavat kontrolli.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}